EasyJet Airlines Spain – Court Ruling (Spain, 2026)

EasyJet Airlines Spain (the controller) is an airline company. In 2024, Unión Sindical Obrera-Sector de Transporte Aéreo (USO-STA, a trade union in the aviation sector) brought a case against the controller to the High Court. The controller published a seniority list on its intranet, as an obligation from its collective bargaining agreement with SITCPLA (Sindicato Independiente de Tripulantes de Cabina de Pasajeros, also a trade union). This list was made for the purpose of regulating access and organising promotions and changes of contract. The controller pseudonymised the identities of the data subjects, replacing their names with a number. The USO-STA requested the court to order the controller to publish the full names of the data subjects, as it considered that the controller did not fully comply with the collective bargaining agreement. According to USO-STA, this obligation complied with the GDPR, because the controller processed data under the legal basis of legal obligation (Article 6(1)(c) GDPR). The High Court dismissed the case on procedural grounds. According to the court, there was no current and real litigious interest, as the controller fulfilled its obligation in relation to the collective bargaining agreement. The court considered the manner in which the controller did this (pseudonymising the data) irrelevant. The trade union appealed the case to the court. The controller argued that it complied with the collective bargaining agreement, and that it pseudonymised the data to comply with the principle of data minimisation (Article 5(1)(c) GDPR) and CJEU case lawSee case C-65/2023 (MK v K GmbH), https://infocuria.curia.europa.eu/tabs/jurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=%22c-65%2F23%22&publishedId=c-65%2F23. In addition, the controller argued that the pseudonymised data allowed data subjects to see their relative position within the company. The court first clarified that the case was admissible, as there was a potential conflict between the collective agreement and national law. The court then considered whether the pseudonymised data fell under the scope of personal data. The court referred to CJEU case lawSee case C-413/23 (European Data Protection Supervisor v Single Resolution Board), margin 72 onwards, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62023CJ0413 and case C-479/22 (OC v European Commission), margin 52-64, https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22c-479%2F22%22&publishedId=c-479%2F22, and stated that if a person is not able to directly or indirectly identify a data subject following pseodonymisation, this pseudonymised data ceases to be personal data for that data subject. The court concluded that personal data has a dynamic and not absolute definition, taking into consideration whether a party has reasonable means to identify a data subject, In principle, therefore, the pseudnymised data would not be considered personal data and fall outside of the scope of the GDPR if the identity of a data subject cannot be linked to the pseudonymised number. The court also noted that, in principle, the controller lawfully pseudonymised the data (as opposed to publishing the full names of data subjects). The court assessed whether the collective bargaining agreement’s obligation to publish the seniority list complied with the GDPR. The court first noted that the controller did not process sensitive personal data (Article 9 GDPR), unless it publishes information related to sensitive data (such as leaves of absence). This was a case by case analysis that fell outside the scope of this case. In terms of lawfulness, the court stated that applicable legal basis was legal obligation (Article 6(1)(c) GDPR), and that the controller could not use the GDPR as a justification to not comply with its collective bargaining agreement. In addition, Article 88 GDPR allows collective bargaining agreements to include provisions on data processing (as an opening clause). Nonetheless, despite the margin of appreciation given to Member States, the collective bargaining agreement must comply with the rest of the provisions of the GDPR. The court considered that employees had the right (under their collective bargaining agreement) to know the job positions and names of other employees. This data, according to the court, is purely work related and has a minor impact on the data subjects. Therefore, including the data subjects’ full names was proportionate and did not violate the principle of data minimisation under the GDPR. The court overturned the decision by the previous court, and stated that the data subjects had the right to have the seniority list include data subjects’ full name, provided that the access to this data is limited.